Static task
static1
Behavioral task
behavioral1
Sample
fd84a27e4af1a857b0aa41ba8552b247_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fd84a27e4af1a857b0aa41ba8552b247_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fd84a27e4af1a857b0aa41ba8552b247_JaffaCakes118
-
Size
61KB
-
MD5
fd84a27e4af1a857b0aa41ba8552b247
-
SHA1
2c76e07c8d91a5d23eb3c1d3914f64148329cdb8
-
SHA256
1695365a431969ab4723f08f37c14a1f927db69a61d155309cca5ba5825d8990
-
SHA512
65735dc93e1093a569cd3ac0a5b39a3e4d0ee415ca51e9eaf1f8a9d052f18f7ccf678aaafb26a6adcbd83dbc4838407767fff11c9dd5eadad1467265328d8301
-
SSDEEP
768:KsZTcW8a6x1vZTRhKlYYV7s8ZQYjUVX2sFsbZVYpBlIBeqWW4jMA5MAO:Ks+FRRhKlYYestDWWuxDO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fd84a27e4af1a857b0aa41ba8552b247_JaffaCakes118
Files
-
fd84a27e4af1a857b0aa41ba8552b247_JaffaCakes118.exe windows:4 windows x86 arch:x86
e208c4b6aa971c731ef3de2976a69dcd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
memset
strncpy
strcmp
memmove
strlen
strcpy
strcat
memcpy
sprintf
strncmp
fclose
fabs
ceil
malloc
floor
free
kernel32
GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
GlobalAlloc
GlobalFree
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
InitializeCriticalSection
GetModuleFileNameA
GetCurrentProcess
DuplicateHandle
CreatePipe
GetStdHandle
HeapAlloc
CreateProcessA
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetTickCount
Sleep
GetVersionExA
FreeLibrary
LoadLibraryA
GetProcAddress
SetLastError
TlsAlloc
GetDriveTypeA
FindFirstFileA
FindClose
GetFileAttributesA
CreateDirectoryA
WriteFile
CreateFileA
ReadFile
SetFilePointer
HeapReAlloc
comctl32
InitCommonControls
InitCommonControlsEx
user32
RegisterHotKey
GetCursorPos
SetCursorPos
GetAsyncKeyState
UnregisterHotKey
GetMessageExtraInfo
GetSystemMetrics
mouse_event
MessageBoxA
GetWindowThreadProcessId
IsWindowVisible
IsWindowEnabled
GetForegroundWindow
EnableWindow
EnumWindows
SetMenu
DestroyMenu
CreatePopupMenu
AppendMenuA
CreateMenu
SetForegroundWindow
TrackPopupMenu
DestroyWindow
SendMessageA
GetWindowLongA
SetWindowTextA
CreateWindowExA
GetWindow
SetWindowLongA
GetWindowRect
GetSysColor
GetSysColorBrush
RemovePropA
ShowWindow
GetParent
ScreenToClient
MoveWindow
RedrawWindow
CallWindowProcA
SetPropA
MapWindowPoints
InvalidateRect
DefWindowProcA
GetPropA
PeekMessageA
TranslateMessage
DispatchMessageA
PostMessageA
SetActiveWindow
UnregisterClassA
DestroyAcceleratorTable
LoadIconA
LoadCursorA
RegisterClassA
AdjustWindowRectEx
GetActiveWindow
CreateAcceleratorTableA
MsgWaitForMultipleObjects
GetMessageA
TranslateAcceleratorA
LoadImageA
SetCursor
SystemParametersInfoA
GetKeyState
SetCapture
ReleaseCapture
GetClientRect
FillRect
EnumChildWindows
DefFrameProcA
SetFocus
GetFocus
IsChild
GetClassNameA
DestroyIcon
GetIconInfo
CreateIconFromResourceEx
CreateIconFromResource
gdi32
GetStockObject
SetBkColor
SetTextColor
CreateSolidBrush
DeleteObject
GetObjectType
CreateCompatibleDC
SetDIBits
DeleteDC
GetObjectA
CreateDCA
CreateDIBSection
GetDIBits
SelectObject
BitBlt
CreateBitmap
SetPixel
ole32
CoInitialize
RevokeDragDrop
shell32
ShellExecuteExA
Sections
.code Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 406B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ